A practical guide to the deadlines, the data you must contribute to the NEHR, the grants available, and where the real preparation work sits.
Anyone who has worked in clinical care will recognise the moment. A patient arrives with a folder of results from several providers, a medication list that may or may not be current, and a history that has to be pieced together within a short consultation. As Singapore's population ages and more care moves from hospitals into the community, fragmented medical records create real risks, including medication errors, duplicate procedures and delayed treatment.
The Health Information Act (HIA) is Singapore's legislative response. The Bill was passed in Parliament on 12 January 2026, and the Act was enacted on 3 February 2026. It provides the legal framework for how health information is contributed, accessed, shared and protected. For most providers, the first obligations begin in September 2027, with other groups following in 2028 and 2030.
This guide explains what the Act requires, who it applies to and when, and where we expect providers to find the work hardest. That last part draws on our own experience at Jonda Health, where our work is turning health records from many different sources into structured, standardised information that clinicians and systems can actually use.
At its heart, the HIA puts Singapore's National Electronic Health Record (NEHR) on a firm legal footing and sets clear rules for everyone who contributes to it or accesses it. Since 2011, the NEHR has connected public hospitals and polyclinics, most private hospitals and a growing number of community providers. What changes now is that contribution is no longer largely voluntary for private and community providers. The Act formalises the NEHR as a national repository holding a consolidated copy of selected health records for Singapore citizens, Permanent Residents and long-term pass holders.
The Act is built around three frameworks.
The first framework requires all licensed healthcare providers under the Healthcare Services Act (HCSA) and retail pharmacies under the Health Products Act (HPA) to contribute key health information to the NEHR, and it governs authorised access to the repository. The second enables prescribed non-NEHR health information to be shared for community-based care and outreach; for now, it applies only to public healthcare institutions, the three cluster headquarters, the Agency for Integrated Care and relevant public agencies. The third requires healthcare providers, retail pharmacies and Health Information Management System (HIMS) vendors to implement reasonable security measures and to notify MOH of significant data breaches and cybersecurity incidents.
It is worth noting how broadly "health information" is defined. It covers administrative information, such as name, address and phone number when used for healthcare purposes, as well as clinical information such as prescriptions, test results, procedures and discharge notes.
MOH has grouped providers into three batches, each with its own deadline to start contributing to the NEHR and to have cybersecurity and data security measures in place.
Batch 1 is the one to watch now. It covers GP clinics, acute and community hospitals, clinical laboratories, radiology laboratories and nuclear medicine services, all of which must start contributing and implementing security measures by September 2027. Batch 2 adds specialist outpatient clinics, nursing homes, contingency care services and outpatient renal dialysis by September 2028. Batch 3 adds outpatient dental clinics, ambulatory surgical centres, assisted reproduction centres and retail pharmacies by March 2030.
Two details are easy to miss. First, licensees providing several service types follow each service's own timeline, so a group running both GP and specialist clinics will work to two deadlines. Second, HCSA licensees outside these batches, such as cord blood banking, tissue banking, emergency ambulance and medical transport services, do not contribute to the NEHR but still need to implement the cyber and data security measures by September 2028.
The core data set includes allergies, vaccinations, diagnoses, medications, laboratory test results, radiological images and discharge summaries. The exact list varies by provider type and is set out in the First Schedule of the Act, so each organisation should check the items that apply to its own services.
These are precisely the categories that tend to arrive in the most varied forms. A lab result may be a structured message, a PDF or a scanned page. A medication may be recorded under a brand name, a generic name or a clinic's own inventory code. A diagnosis may be a coded entry or a phrase typed at the end of a consultation. We return to this below, because it is where much of the practical effort will sit.
This is one of the most significant shifts in the Act. The Personal Data Protection Act (PDPA) is built largely around consent before disclosure. The HIA instead creates a statutory basis for sharing health information across the healthcare ecosystem.
Patients are not left without visibility or control. They can view key NEHR information, including medications, drug allergies and lab results, through HealthHub, and they can see which institutions have accessed their record over the past 12 months. Patients may also place an Access Restriction on their NEHR records, although providers must still contribute their information so the record remains complete. From 2027, a limited set of essential information, including drug allergies and vaccination records, will remain visible to authorised providers for patient safety.
For providers, this means patient conversations will change. Front-desk and clinical teams should be ready to explain what is shared, why, and what choices patients have.
The security obligations apply to providers, retail pharmacies and HIMS vendors alike. Beyond reasonable technical measures, providers must notify affected individuals if a data breach is likely to cause them significant harm, and they need appropriate standard operating procedures and staff training. MOH's CS/DS Essentials document is the practical starting point.
Funding is available to help. The NEHR Connect Grant (NCG) supports eligible providers in enhancing an existing HIMS or adopting an HIA-compliant one, and it sits alongside cybersecurity grants from other agencies.
Figures from MOH's HIA implementation support page. As an illustration, MOH estimates that a solo GP practice would receive approximately $20,000 in combined support across these schemes.
Much of the discussion around the HIA focuses on systems (choosing a compliant HIMS) and security (meeting the CS/DS Essentials). Both matter. In our experience, though, the part organisations most often underestimate is the condition of the data that has to flow through those systems.
MOH's own process hints at this. After a grant is approved, providers have a data quality monitoring window of up to two months after their mandatory contribution date to meet data quality requirements. Onboarding resources from Synapxe, the operator of the NEHR, likewise include guidance on mandatory data contribution requirements and drug inventory mapping. In other words, connecting is only the first step. What is contributed has to be accurate, consistent and mapped to the expected standards.
In the records we work with across the region, the same patterns appear again and again. The same laboratory test may be named in several different ways across providers, with different units and reference ranges. Results from partner labs or overseas providers often arrive as PDFs or scanned images, sometimes in another language. Medications appear under brand names, generic names and local inventory codes. Diagnoses are often captured as free text. Discharge summaries and imaging reports carry vital context in narrative form. Many institutions also maintain their own internal code sets, which need careful mapping rather than a one-size-fits-all conversion. None of this reflects poor practice; it is simply how clinical data is created in busy settings, across systems that were never designed to speak to each other.
AI can do a great deal of this work at speed, and we use it extensively ourselves. The lesson we have learned, however, is that speed alone is not enough in a regulated setting. Teams that try to build this layer in-house often find that costs climb as models are run repeatedly over the same documents, that general-purpose AI tools raise questions about where patient data is processed, and that without clinical review and quality checks, errors pass silently into systems other clinicians will rely on. A national record is only as trustworthy as what goes into it, which is why we argue that healthcare AI will not work without trusted data infrastructure. The checks and balances deserve as much attention as the automation.
Singapore is often watched as a reference point in the region, and the HIA is likely to be studied well beyond its borders. Its lesson is a simple one: interoperability at national scale depends less on any single system and more on the quality and consistency of the data inside every system.
There is also an upside that goes beyond compliance. MOH notes that NEHR data can help shape national health policy and support research to improve population health. The same is true inside each organisation. Clean, structured, standardised records make care coordination safer, reporting easier, and analytics and AI far more reliable. Where records are later reused for research or analytics, they also need the right privacy protections, and the distinctions matter more than many teams expect; we explain them in De-identification, Pseudonymisation and Anonymisation: What the Difference Means for Your Health Data.
Treated well, the effort the HIA requires becomes an investment in a data asset rather than simply a compliance cost. We explore that idea further in When Health Data Becomes an Asset: What Readiness Actually Requires.
The Act was enacted on 3 February 2026. Obligations phase in by batch: September 2027, September 2028 and March 2030, depending on the type of healthcare service.
Yes. GP clinics are in Batch 1 and must start contributing by September 2027. They can apply for a fixed NEHR Connect Grant of $8,400 per licensee.
No. The HIA creates a statutory basis for contribution. Patients can view their records and access history on HealthHub and can place an Access Restriction, but providers must still contribute.
It is a necessary step but not the whole picture. Providers also need to meet the cyber and data security requirements and the data quality requirements for what they contribute.
The core categories include allergies, vaccinations, diagnoses, medications, lab results, radiological images and discharge summaries. The precise list for each provider type is set out in the First Schedule of the Act.
Sources: Ministry of Health, healthinfo.gov.sg (HIA overview and implementation support pages, updated September 2026); gov.sg; Singapore Statutes Online; Baker McKenzie; Medical Protection Society. This article is for general information and is not legal advice.
Suhina Singh is the founder and CEO of Jonda Health, a Singapore-based health data infrastructure company. A physician by training, she works with health systems across Asia-Pacific to harmonise, de-identify and standardise clinical data so it can be trusted and used. Jonda Health is ISO 27001 certified.
